Various methods are conceivable for attaining high reliability in a control unit. The most common method has been to specify high reliability of each hardware component used in the control unit. More specifically, the method has included requiring high reliability for selected parts and securing a satisfactory design tolerance, or screening and aging parts and limiting the number of working parts through the application of integrated circuits. However there are limits to the degree of reliability that can be attained at the hardware level. Therefore, both the necessity and the effectiveness of securing high reliability at the system level have been widely recognized in recent times.
For example, in a system with the conventional single control unit, a single capacitor or transistor malfunctioning can greatly affect the entire control system. In fact, an analysis of causes of malfunctions in a control system in the past indicates that this kind of trouble is the most frequent cause. It is therefore that a multiplexing control system is called for.
A multiplexing control unit for control systems is given, for example, in FIG. 1. Toshiba BWR Power Control System ADMIX with Triple-Control Channel and Self-Diagnoses, on pages 406 to 411 of "BWR PLANTS IN JAPAN--A NEW PERSPECTIVE", reported in TRANSACTIONS OF THE AMERICAN NUCLEAR SOCIETY AND THE EUROPEAN NUCLEAR SOCIETY 1980 INTERNATIONAL CONFERENCE ON WORLD NUCLEAR ENERGY--ACCOMPLISHMENTS AND PERSPECTIVES, Vol. 35. One example of a mean value selected triplex plant control unit is disclosed in the FIG. 1. In this triplex plant control unit, the process signals, "reactor water level," "feedwater flow," and "main steam flow" used for control as feedback signals are triplex and each is input, to a mean value selector circuit, MVG, which outputs a mean value selected from the three signals. The signal selected through the mean value selector circuit, MVG, is input to a triplex master controller M/C. The mean value of three output signals computed by each M/C is input to the mean value selector circuit, MVG, and the output is input to a secondary controller S/C. The mean value selector circuit, MVG, is constituted, for example, of a high value input selector circuit and a low value input selector circuit.
In this system, however, since a malfunction in the mean value selector circuit is part of a common mode, the effect will be reduced by half unless the mean value selector circuit MVG has been made highly reliable. Then, if a multiplex unit including the power supply finally is considered, a power abnormality in the mean value selector circuit can lead to an abnormality in the entire triplex plant control unit. Furthermore, when the control unit has a multiple output, since the system takes a mean value at each output signal, each control unit contributes to the error occurring because of a hunting phenomenon, depending on the system to be controlled.